Blunt list-testing against your sign-in. Attackers replay stolen username/password pairs at scale; a CAPTCHA on sign-in plus two Lidar monitors makes the attempt expensive, surfaces it as a Signal, and keeps a real user's failed sign-in from looking like an attack.

## What you use

- [Bot protection](/docs/bot-protection) with reCAPTCHA **v3** on `signin` (v3, because `signin` can render a checkbox but a silent score is less disruptive for real users).
- The Lidar `brute_force` monitor (`detection:brute_force attempts:>100 window:5m`), correlated by IP.
- The Lidar `credential_stuffing` monitor (`detection:credential_stuffing attempts:>200 window:15m`), correlated across the environment.

## Setup

1. Add a reCAPTCHA **v3** site in the [console](https://console.authdog.com) under **Authentication > Add-ons**, and select the `signin` action.
2. Set the minimum score to `0.5` initially; reject tokens scoring below it and require the echoed action to match `signin` so a token minted on another page cannot be replayed.
3. Under **Lidar > Monitors**, enable `brute_force` and `credential_stuffing`. Tune `attempts:` and `window:` to your traffic shape; a busy environment needs higher floors than the defaults or every legitimate sign-in wave looks like an attack.

## Verify

- Replay a small list of bad credentials from one IP in dev: v3 drops the low-score attempts, `brute_force` fires on the IP, and `credential_stuffing` fires across the environment once the floor is crossed.
- Confirm a real user with a wrong password does not raise a Signal; the monitors key on volume, not single failures.
- Triage the resulting Signals in [Lidar > Signals](/docs/console/lidar); the dedup keys keep re-analysis from creating duplicate alerts.

## Related

- [Prevent signup and free-trial abuse](/docs/recipes/prevent-signup-abuse): the same front-door control aimed at sign-up.
- [MFA](/docs/mfa): the second factor that contains a stolen password.
- [Lidar concepts](/docs/concepts/lidar): monitor query syntax and correlation keys.
- [Bot protection](/docs/bot-protection): v3 score handling and fail-closed behavior.